| 1 | name: Web Frontend |
| 2 | |
| 3 | on: |
| 4 | push: |
| 5 | branches: [master, main] |
| 6 | pull_request: |
| 7 | branches: [master, main] |
| 8 | workflow_dispatch: |
| 9 | |
| 10 | permissions: |
| 11 | contents: read |
| 12 | |
| 13 | jobs: |
| 14 | lint: |
| 15 | name: Lint & Type Check |
| 16 | runs-on: ubuntu-latest |
| 17 | defaults: |
| 18 | run: |
| 19 | working-directory: web |
| 20 | steps: |
| 21 | - uses: actions/checkout@v7 |
| 22 | with: |
| 23 | # `check:facts` derives each model's `addedAt` from the commit date on |
| 24 | # which its id first appeared in the model declaration paths |
| 25 | # (web/scripts/facts-lib.mjs). A shallow checkout cannot see that |
| 26 | # history, so every date collapses to the tip commit and the committed |
| 27 | # facts always read as stale. ci.yml pins depth 0 for the same reason. |
| 28 | fetch-depth: 0 |
| 29 | - uses: actions/setup-node@v7 |
| 30 | with: |
| 31 | node-version: 22 |
| 32 | cache: 'npm' |
| 33 | cache-dependency-path: web/package-lock.json |
| 34 | - name: Install dependencies |
| 35 | run: npm ci |
| 36 | - name: Run tests |
| 37 | run: npm test |
| 38 | - name: Check web surface |
| 39 | # The shared gate checks committed facts before generating build inputs. |
| 40 | env: |
| 41 | GITHUB_TOKEN: ${{ github.token }} |
| 42 | run: npm run check |
| 43 | |
| 44 | deploy-reminder: |
| 45 | name: Deployment approval needed |
| 46 | runs-on: ubuntu-latest |
| 47 | needs: lint |
| 48 | if: github.event_name == 'push' && github.ref == 'refs/heads/main' |
| 49 | steps: |
| 50 | - name: Surface the manual deployment gate |
| 51 | env: |
| 52 | REVISION: ${{ github.sha }} |
| 53 | run: | |
| 54 | echo "::notice title=Web deployment approval needed::Revision ${REVISION} passed the web gates but is not deployed. Dispatch web.yml on main to publish it." |
| 55 | { |
| 56 | echo "## Web deployment approval needed" |
| 57 | echo |
| 58 | echo "Revision \`${REVISION}\` passed the web gates but has **not** been deployed." |
| 59 | echo |
| 60 | echo "A maintainer can publish it with \`gh workflow run web.yml --repo Hmbown/CodeWhale --ref main\`." |
| 61 | } >> "$GITHUB_STEP_SUMMARY" |
| 62 | |
| 63 | deploy: |
| 64 | name: Deploy to Cloudflare |
| 65 | runs-on: ubuntu-latest |
| 66 | needs: lint |
| 67 | # Deploy is MANUAL ONLY: a human dispatches this workflow on main. Pushes |
| 68 | # and pull requests still run `lint` above, but they never reach Cloudflare. |
| 69 | # This mirrors scripts/check-cloudflare-deploy-env.mjs, which fails closed |
| 70 | # unless GITHUB_EVENT_NAME is workflow_dispatch, GITHUB_REF is |
| 71 | # refs/heads/main, and GITHUB_SHA is an exact 40-hex revision — a push |
| 72 | # trigger here would only produce a red job after `lint` had already run. |
| 73 | # lib/deploy-preflight.test.ts asserts both halves of that contract. |
| 74 | # `needs: lint` is the gate: facts drift, docs parity, tests, ESLint, tsc, |
| 75 | # and a production build all pass before anything reaches Cloudflare. |
| 76 | if: >- |
| 77 | github.event_name == 'workflow_dispatch' |
| 78 | && github.ref == 'refs/heads/main' |
| 79 | # Serialize deploys so two dispatches landing close together cannot race and |
| 80 | # leave Cloudflare serving the older bundle. Never cancel in progress: a |
| 81 | # half-finished OpenNext upload is worse than a queued one. |
| 82 | concurrency: |
| 83 | group: deploy-codewhale-web |
| 84 | cancel-in-progress: false |
| 85 | defaults: |
| 86 | run: |
| 87 | working-directory: web |
| 88 | env: |
| 89 | CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} |
| 90 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 91 | steps: |
| 92 | - uses: actions/checkout@v7 |
| 93 | # Pin the checkout to the exact revision this dispatch resolved, so the |
| 94 | # SHA reported to compare:deployed-facts and asserted on the public |
| 95 | # receipt below is the SHA that was actually built, even if main moves |
| 96 | # while the run is queued behind the concurrency group. |
| 97 | with: |
| 98 | ref: ${{ github.sha }} |
| 99 | - uses: actions/setup-node@v7 |
| 100 | with: |
| 101 | node-version: 22 |
| 102 | cache: 'npm' |
| 103 | cache-dependency-path: web/package-lock.json |
| 104 | - name: Install dependencies |
| 105 | run: npm ci |
| 106 | - name: Record deployed/source drift |
| 107 | # Read-only and credential-free. A mismatch is the normal state here — |
| 108 | # it is the gap this run is about to close — so this step reports |
| 109 | # without gating. The real assertion is the post-deploy verification |
| 110 | # below, which must observe this exact revision on the public receipt. |
| 111 | run: npm run compare:deployed-facts -- --expected-revision "$GITHUB_SHA" |
| 112 | - name: Check Cloudflare deploy environment |
| 113 | run: npm run check:deploy-env |
| 114 | # npm's deploy script performs one OpenNext build, then deploys that exact |
| 115 | # bundle. Wrangler must not run a custom post-cache build: OpenNext |
| 116 | # populates the remote cache before it hands the bundle to Wrangler. |
| 117 | - name: Build and deploy exact OpenNext bundle |
| 118 | run: npm run deploy |
| 119 | - name: Verify exact deployed revision |
| 120 | # The public /api/facts receipt must identify this workflow's exact |
| 121 | # checkout before the manual deployment run can finish green. |
| 122 | run: npm run check:deployed-facts -- --expected-revision "$GITHUB_SHA" --attempts 10 --retry-delay-ms 3000 |
| 123 |